<?php
/**
 * Settings page for Agenized Chat Widget.
 *
 * @package AgenizedChatWidget
 */

namespace AgenizedChatWidget;

if (!defined('ABSPATH')) {
	exit;
}

final class SettingsPage {
	private const MENU_SLUG = 'agenized-chat-widget';

	public static function init(): void {
		add_action('admin_menu', [self::class, 'register_menu']);
		add_action('admin_init', [self::class, 'register_settings']);
	}

	public static function register_menu(): void {
		add_options_page(
			'Agenized Chat Widget',
			'Agenized Chat Widget',
			'manage_options',
			self::MENU_SLUG,
			[self::class, 'render']
		);
	}

	public static function register_settings(): void {
		register_setting('agenized_chat_widget', Options::OPT_API_BASE_URL, [
			'type' => 'string',
			'sanitize_callback' => [self::class, 'sanitize_url'],
			'default' => Defaults::merchant_api_base_url(),
		]);
		register_setting('agenized_chat_widget', Options::OPT_WIDGET_API_BASE_URL, [
			'type' => 'string',
			'sanitize_callback' => [self::class, 'sanitize_url'],
			'default' => Defaults::widget_api_base_url(),
		]);
		register_setting('agenized_chat_widget', Options::OPT_PORTAL_BASE_URL, [
			'type' => 'string',
			'sanitize_callback' => [self::class, 'sanitize_url'],
			'default' => Defaults::merchant_portal_base_url(),
		]);
		register_setting('agenized_chat_widget', Options::OPT_WIDGET_SCRIPT_URL, [
			'type' => 'string',
			'sanitize_callback' => [self::class, 'sanitize_url'],
			'default' => Defaults::widget_script_url(),
		]);
		register_setting('agenized_chat_widget', Options::OPT_OAUTH_CLIENT_ID, [
			'type' => 'string',
			'sanitize_callback' => 'sanitize_text_field',
			'default' => Defaults::oauth_client_id(),
		]);
		register_setting('agenized_chat_widget', Options::OPT_OAUTH_CLIENT_SECRET, [
			'type' => 'string',
			'sanitize_callback' => 'sanitize_text_field',
			'default' => '',
		]);
		register_setting('agenized_chat_widget', Options::OPT_OAUTH_SCOPES, [
			'type' => 'string',
			'sanitize_callback' => [self::class, 'sanitize_scopes'],
			'default' => Defaults::oauth_scopes(),
		]);

		register_setting('agenized_chat_widget', Options::OPT_CHANNEL_ID, [
			'type' => 'string',
			'sanitize_callback' => 'sanitize_text_field',
			'default' => '',
		]);
	}

	public static function sanitize_url(string $val): string {
		$val = trim($val);
		if ($val === '') {
			return '';
		}
		$val = esc_url_raw($val);
		return rtrim($val, '/');
	}

	public static function sanitize_scopes(string $val): string {
		$val = sanitize_text_field($val);
		$parts = preg_split('/\s+/', $val, -1, PREG_SPLIT_NO_EMPTY);
		$out = [];
		foreach ($parts as $part) {
			$part = sanitize_text_field((string) $part);
			if ($part === '') {
				continue;
			}
			// Allow typical OAuth scope tokens only (e.g. read:conversations).
			if (!preg_match('/^[a-z][a-z0-9:_\/.\-]*$/i', $part)) {
				continue;
			}
			$out[] = $part;
		}
		return implode(' ', $out);
	}

	public static function render(): void {
		if (!current_user_can('manage_options')) {
			return;
		}

		// Handle OAuth callback if present.
		$oauth_result = OAuth::handle_callback_if_present();

		// Handle actions.
		$notice = null;
		if (isset($_POST['agenized_chat_widget_action'])) {
			check_admin_referer('agenized_chat_widget_actions');
			$action = sanitize_text_field(wp_unslash($_POST['agenized_chat_widget_action']));

			if ($action === 'disconnect') {
				OAuth::disconnect();
				$notice = ['type' => 'success', 'text' => 'Disconnected.'];
			}

			if ($action === 'save_channel') {
				$channel_id = isset($_POST['agenized_chat_widget_channel_id']) ? sanitize_text_field(wp_unslash($_POST['agenized_chat_widget_channel_id'])) : '';
				if ($channel_id === '') {
					Options::delete(Options::OPT_CHANNEL_ID);
					Options::delete(Options::OPT_CHANNEL_PUBLIC_KEY);
					$notice = ['type' => 'success', 'text' => 'Channel selection cleared.'];
				} else {
					$ch = AgenizedApi::get_channel($channel_id);
					if (!$ch['ok']) {
						$notice = ['type' => 'error', 'text' => 'Failed to fetch channel: ' . ($ch['message'] ?? '')];
					} else {
						$channel = $ch['channel'] ?? [];
						$public_key = is_array($channel) && isset($channel['public_key']) ? (string) $channel['public_key'] : '';
						if ($public_key === '') {
							$notice = ['type' => 'error', 'text' => 'Channel has no public_key. Make sure it is a chat_widget channel.'];
						} else {
							Options::update_string(Options::OPT_CHANNEL_ID, $channel_id);
							Options::update_string(Options::OPT_CHANNEL_PUBLIC_KEY, $public_key);
							$notice = ['type' => 'success', 'text' => 'Channel saved.'];
						}
					}
				}
			}
		}

		if (is_array($oauth_result)) {
			$notice = ['type' => ($oauth_result['ok'] ? 'success' : 'error'), 'text' => $oauth_result['message']];
		}

		$is_connected = OAuth::is_connected();

		$channels = null;
		if ($is_connected) {
			$list = AgenizedApi::list_chat_widget_channels();
			if ($list['ok']) {
				$channels = $list['channels'];
			} else {
				$notice = $notice ?: ['type' => 'error', 'text' => 'Failed to load channels: ' . ($list['message'] ?? '')];
			}
		}

		$selected_channel_id = Options::get_string(Options::OPT_CHANNEL_ID, '');
		$selected_public_key = Options::get_string(Options::OPT_CHANNEL_PUBLIC_KEY, '');

		$connect_url = OAuth::begin_auth_url();

		?>
		<div class="wrap">
			<h1>Agenized Chat Widget</h1>

			<?php if ($notice): ?>
				<div class="notice notice-<?php echo esc_attr($notice['type']); ?> is-dismissible">
					<p><?php echo esc_html($notice['text']); ?></p>
				</div>
			<?php endif; ?>

			<h2>Configuration</h2>
			<form method="post" action="options.php">
				<?php settings_fields('agenized_chat_widget'); ?>
				<table class="form-table" role="presentation">
					<tr>
						<th scope="row"><label for="<?php echo esc_attr(Options::OPT_API_BASE_URL); ?>">Merchant API Base URL</label></th>
						<td>
							<input name="<?php echo esc_attr(Options::OPT_API_BASE_URL); ?>" id="<?php echo esc_attr(Options::OPT_API_BASE_URL); ?>" type="url" class="regular-text"
								value="<?php echo esc_attr(Options::get_string(Options::OPT_API_BASE_URL, Defaults::merchant_api_base_url())); ?>" />
							<p class="description">Used by WordPress (server-side) for OAuth/token + channel selection. Example: <code>http://host.docker.internal:8010</code></p>
						</td>
					</tr>
					<tr>
						<th scope="row"><label for="<?php echo esc_attr(Options::OPT_WIDGET_API_BASE_URL); ?>">Widget API Base URL</label></th>
						<td>
							<input name="<?php echo esc_attr(Options::OPT_WIDGET_API_BASE_URL); ?>" id="<?php echo esc_attr(Options::OPT_WIDGET_API_BASE_URL); ?>" type="url" class="regular-text"
								value="<?php echo esc_attr(Options::get_string(Options::OPT_WIDGET_API_BASE_URL, Defaults::widget_api_base_url())); ?>" />
							<p class="description">Used by the browser widget JS. Example: <code>http://localhost:8010</code></p>
						</td>
					</tr>
					<tr>
						<th scope="row"><label for="<?php echo esc_attr(Options::OPT_PORTAL_BASE_URL); ?>">Merchant Portal Base URL</label></th>
						<td>
							<input name="<?php echo esc_attr(Options::OPT_PORTAL_BASE_URL); ?>" id="<?php echo esc_attr(Options::OPT_PORTAL_BASE_URL); ?>" type="url" class="regular-text"
								value="<?php echo esc_attr(Options::get_string(Options::OPT_PORTAL_BASE_URL, Defaults::merchant_portal_base_url())); ?>" />
							<p class="description">Must host the consent page at <code>/oauth/authorize</code>.</p>
						</td>
					</tr>
					<tr>
						<th scope="row"><label for="<?php echo esc_attr(Options::OPT_WIDGET_SCRIPT_URL); ?>">Widget Script URL (optional)</label></th>
						<td>
							<input name="<?php echo esc_attr(Options::OPT_WIDGET_SCRIPT_URL); ?>" id="<?php echo esc_attr(Options::OPT_WIDGET_SCRIPT_URL); ?>" type="url" class="regular-text"
								value="<?php echo esc_attr(Options::get_string(Options::OPT_WIDGET_SCRIPT_URL, Defaults::widget_script_url())); ?>" />
							<p class="description">If empty, plugin uses its bundled <code>assets/widget.js</code>.</p>
						</td>
					</tr>
					<tr>
						<th scope="row"><label for="<?php echo esc_attr(Options::OPT_OAUTH_CLIENT_ID); ?>">OAuth Client ID</label></th>
						<td>
							<input name="<?php echo esc_attr(Options::OPT_OAUTH_CLIENT_ID); ?>" id="<?php echo esc_attr(Options::OPT_OAUTH_CLIENT_ID); ?>" type="text" class="regular-text"
								value="<?php echo esc_attr(Options::get_string(Options::OPT_OAUTH_CLIENT_ID, Defaults::oauth_client_id())); ?>" />
						</td>
					</tr>
					<tr>
						<th scope="row"><label for="<?php echo esc_attr(Options::OPT_OAUTH_CLIENT_SECRET); ?>">OAuth Client Secret (optional)</label></th>
						<td>
							<input name="<?php echo esc_attr(Options::OPT_OAUTH_CLIENT_SECRET); ?>" id="<?php echo esc_attr(Options::OPT_OAUTH_CLIENT_SECRET); ?>" type="password" class="regular-text"
								value="<?php echo esc_attr(Options::get_string(Options::OPT_OAUTH_CLIENT_SECRET, '')); ?>" autocomplete="new-password" />
							<p class="description">Leave empty for a public (PKCE) client.</p>
						</td>
					</tr>
					<tr>
						<th scope="row"><label for="<?php echo esc_attr(Options::OPT_OAUTH_SCOPES); ?>">OAuth Scopes</label></th>
						<td>
							<input name="<?php echo esc_attr(Options::OPT_OAUTH_SCOPES); ?>" id="<?php echo esc_attr(Options::OPT_OAUTH_SCOPES); ?>" type="text" class="regular-text"
								value="<?php echo esc_attr(Options::get_string(Options::OPT_OAUTH_SCOPES, Defaults::oauth_scopes())); ?>" />
							<p class="description">Space-separated. Must be allowed on the OAuth client.</p>
						</td>
					</tr>
				</table>
				<?php submit_button('Save settings'); ?>
			</form>

			<hr />

			<h2>Connection</h2>
			<?php if ($is_connected): ?>
				<p><strong>Status:</strong> Connected</p>
				<form method="post">
					<?php wp_nonce_field('agenized_chat_widget_actions'); ?>
					<input type="hidden" name="agenized_chat_widget_action" value="disconnect" />
					<?php submit_button('Disconnect', 'delete'); ?>
				</form>
			<?php else: ?>
				<p><strong>Status:</strong> Not connected</p>
				<?php if ($connect_url === ''): ?>
					<p>Please set the OAuth Client ID and save settings first.</p>
				<?php else: ?>
					<p>
						<a class="button button-primary" href="<?php echo esc_url($connect_url); ?>">Connect via OAuth</a>
					</p>
					<p class="description">
						Redirect URI to whitelist on the OAuth client:<br/>
						<code><?php echo esc_html(self::current_redirect_uri()); ?></code>
					</p>
				<?php endif; ?>
			<?php endif; ?>

			<hr />

			<h2>Chats Channel</h2>
			<?php if (!$is_connected): ?>
				<p>Connect via OAuth first.</p>
			<?php else: ?>
				<form method="post">
					<?php wp_nonce_field('agenized_chat_widget_actions'); ?>
					<input type="hidden" name="agenized_chat_widget_action" value="save_channel" />

					<table class="form-table" role="presentation">
						<tr>
							<th scope="row">Selected channel</th>
							<td>
								<select name="agenized_chat_widget_channel_id">
									<option value="">— Select —</option>
									<?php if (is_array($channels)): ?>
										<?php foreach ($channels as $ch): ?>
											<?php
											$id = is_array($ch) && isset($ch['id']) ? (string) $ch['id'] : '';
											$name = is_array($ch) && isset($ch['name']) ? (string) $ch['name'] : $id;
											?>
											<option value="<?php echo esc_attr($id); ?>" <?php selected($selected_channel_id, $id); ?>>
												<?php echo esc_html($name); ?>
											</option>
										<?php endforeach; ?>
									<?php endif; ?>
								</select>
								<?php if ($selected_public_key !== ''): ?>
									<p class="description">public_key: <code><?php echo esc_html($selected_public_key); ?></code></p>
								<?php endif; ?>
							</td>
						</tr>
					</table>

					<?php submit_button('Save channel'); ?>
				</form>
			<?php endif; ?>
		</div>
		<?php
	}

	private static function current_redirect_uri(): string {
		return OAuth::get_redirect_uri();
	}
}